Common User Management Errors

Summary

The following table is a list of the most common LDAP Errors encountered when integrating LDAP with Atlassian products. For a product-agnostic list of all LDAP error codes, please see the LDAP Protocol Specification. For product-specific information, please see your product documentation.

Solution

The Bind account referred to by many messages is the username and password that your Atlassian products use to access your LDAP directory.

LDAP Error 1

This is an internal error, and the LDAP Server isn't able to respond with a more specific error. Usually, this indicates an error at the LDAP server, rather than a problem with the request that was made.

Solution

Check the LDAP Server logs and configuration to ensure that it is working free from errors. When a user attempts to log in to an Atlassian application, the server:

1. Search for the administrative user's DN, using the admin account's credentials from the User Directory configuration.

2. Binds to LDAP using the DN from step 1.

3. Searches for the user that is attempting to authenticate.

4. Attempts to bind as that user using the password provided.

5. If the bind is successful, that user will have their details synchronized with the target directory.

In this particular case, step 1 is failing. This is usually due to the user's password requiring a reset, the admin is unable to log in or it is not an official administrator for the LDAP engine.

Possible solutions/checks:

1. Verify the user's password trying to login to the Atlassian application does not require a reset on the next login.

2. Check that you can log in as that user in another system that is connected to the same LDAP engine.

3. Ensure that the user configured to bind to the LDAP server is an actual administrator of the LDAP engine (i.e. in an Active Directory they are a member of the Administrator built-in group). If the user is not Administrator, make sure it has read-only access to all directory levels used by your Atlassian application.

4. a group (or groups) has a name that has two leading spaces. Execute the following query to determine if there are any groups like that, in the specified directory:

   select id, group_name from cwd_group where directory_id = '1234567' and group_name like '% %';

• • Determine which groups have names with leading spaces by running the diagnostic query above

  • Rename the problematic groups in Active Directory by removing the leading spaces

  • Restart synchronization

LDAP Error 3

The time limit for an operation (set by the client or server) has been exceeded. If the operation is a search, the results will be incomplete.

Solution

Reaching the timeout is usually a sign that:

• the timeout is too short - adjust it by editing your directory and increasing the Search Timeout parameter; or

• a result set is too large - adjust filters to reduce the result set

LDAP Error 4

The size limit (set by the client or server) has been exceeded. The results returned will be incomplete.

Solution

Reaching a limit is usually a sign that:

• the limit is not appropriate - adjust Paged Results and ensure the Page Size is smaller than the limit in the User Directories Advanced Settings.

  • Consult with your LDAP/AD System Administrator to see what this number should be set to as it depends on the LDAP/AD server configuration; or

• The result set is too large and you could adjust filters to reduce the result set

LDAP Error 8

The Active Directory server has a non-default domain policy set that enforces all LDAP authentication to be secured with SSL.

Solution

• Change the policy to allow non-secure connections; or

• Connect to AD using LDAPS.

LDAP Error 10

A referral must be followed by the client in order to complete the operation.

Solution

1. Typically, this error is accompanied by LimitExceededException - Too many referrals were made; usually to a DNS address that does not exist. Ensure that the base DN is correct and free from typographical errors.

2. Ensure that users have correct MemberOf attributes that points to correct groups that are reachable. To test this, change how membership is being defined by unchecking the MemberOf setting in the Membership Schema Attribute Settings. This will list membership by searching through Groups' "Member" attribute instead of searching through Users' "MemberOf" attribute

LDAP Error 12

Sun Directory Server does not support Paged Results which generates an error like:

Solution

Do not use Paged Results in Sun Directory Server. Note that without paged results, you may encounter LDAP error code 4. More discussion has taken place on CONFSERVER-22083 - Assess Sun Directory LDAP server and paged results support for Confluence compatibility .

LDAP Error 17

One of the attributes specified in the configuration settings of your User Directory either in the Group Schema Settings (i.e. User Object Class, User Last Name Attribute etc.) or User Schema Settings (i.e. Group Name Attribute, Group Name Class) sections do not exist in the LDAP server's schema.

Solution

Ensure any attributes referenced in your configuration are correct, and appropriate for users or groups.

LDAP Error 32

There could be many reasons for this issue. Please check the data code in the error message.

Solution

javax.naming.NameNotFoundException: [LDAP: error code 32 - 0000208D: NameErr: DSID-0310020A,

problem 2001 (NO_OBJECT), data 0, best match of: 'ou=fake, ou=users, o=sevenSeas'];

remaining name 'ou=users, o=sevenSeas'

The data code in the example above is 0 which means that "Defined DN does not exist".

LDAP Error 34

The syntax of the DN is incorrect.

Solution

Ensure your DN is correct; and free from typographical errors. There may also be an invalid character in an attribute of the object - such as name or description. Check the error message to see the attribute that caused the problem.

LDAP Error 49

The bind operation has failed, typically due to a problem with the account.

Solution

Ensure the credentials for the bind account used to connect to the LDAP Server are correct. If you are using Active Directory, refer to the table below about Error 49 in Active Directory.

This can also be caused by not using the FQDN in the Username field at the User Directory configuration. Try changing Username to "user@domain.name"

LDAP Error 50

The LDAP user configured on the client (i.e. JIRA, Confluence etc) does not have sufficient rights to perform the requested operation.

Solution

This error is a permissions configuration issue on the LDAP side. Ensure that the bind account has sufficient privileges to perform the operation requested. If possible, try an account with higher permissions temporarily to isolate the problem.

LDAP Error 53

The LDAP server cannot process the request because of server-defined restrictions. This error is returned for the following reasons:

• The add entry request violates the LDAP Server's structure rules

• The modify attribute request specifies attributes that users cannot modify

• Password restrictions prevent the action

• Connection restrictions prevent the action

Solution

This error is typically caused by attempting to make changes to a read-only directory. There can be several reasons the directory is read-only:

• The directory has been configured as a read-only directory

• The bind account may not have permissions to make changes on the server

• The server may impose additional restrictions. For example, Active Directory may require a secure connection to allow changes

Active Directory Error 49

When Error 49 is encountered, check the error message for a specific error message in the Data attribute of the error message. This TechNet article has more information about how to configure user account settings in Active Directory.

PKIX Path Building Failed while connecting to Secure LDAP (LDAPS)

This error is caused by using a secure LDAP connection - however, your application does not trust the certificate presented by your LDAP server. To resolve this, the certificate must be imported to your application's trust store. Please see Unable to Connect to SSL Services knowledge base article for more information. For product specific advice, please see the Connecting to SSL Services KB document.